LlamaIndex CVE-2024-14021

Exploitation requires that the attacker can place a crafted persist directory - specifically a malicious multi_embed_store.pkl - where the victim will load it, AND that the victim invokes BGEM3Index.load_from_disk() on that attacker-influenced persist_dir. The exact prerequisite feature is use of the BGE-M3 managed index (llama_index/indices/managed/bge_m3) with on-disk persistence; applications that do not load BGE-M3 indexes from untrusted directories are not exposed. Limiting factors per the CVSS vector: it is not remote (AV:L) and requires victim interaction (UI:A) - no code runs until the victim loads the malicious index - which is why it depends on social engineering or a poisoned shared/downloaded artifact rather than unauthenticated remote triggering; no prior authentication on the victim system is modeled (PR:N).

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H) scores 8.4 (High) and is internally consistent with the description: exploitation is local and requires victim action (UI:A) - the victim must load a malicious persist directory - but grants full confidentiality, integrity, and availability impact via code execution. This is a classic 'trusted-input' RCE whose real-world risk hinges entirely on how the persist directory reaches the victim (shared/downloaded index, multi-tenant storage, supply-chained artifact). The signals are somewhat contradictory: severity is High and public POC exists, yet EPSS is only 0.08% (24th percentile) and there is no KEV listing, reflecting that exploitation is not network-automatable and depends on social engineering or a malicious artifact rather than mass, remote scanning. This is a genuine risk for anyone loading third-party or user-supplied LlamaIndex artifacts, but not a drive-by internet-facing emergency; prioritize based on whether your deployment ingests untrusted index directories.

An attacker crafts a persist directory containing a malicious multi_embed_store.pkl whose pickle payload executes a reverse shell on unpickling, then distributes it as a 'pre-built' or 'shared' LlamaIndex BGE-M3 index (e.g., via a download link, model hub, or shared storage). When the victim developer or application calls BGEM3Index.load_from_disk() pointing at that directory, arbitrary code runs with the victim's privileges. Public POC/exploit material exists via the huntr bounty submission, and the local vector with low complexity makes exploitation reliable once the victim is induced to load the artifact.